Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 03:26
Static task
static1
Behavioral task
behavioral1
Sample
2ed592b6374a126f4864eef2129cc33d_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2ed592b6374a126f4864eef2129cc33d_JaffaCakes118.html
Resource
win10v2004-20240708-en
General
-
Target
2ed592b6374a126f4864eef2129cc33d_JaffaCakes118.html
-
Size
9KB
-
MD5
2ed592b6374a126f4864eef2129cc33d
-
SHA1
5264a7b04c85f3e5060a4414cb020a29b02dd0ac
-
SHA256
1789e2b9e34ac4d905cef5922f392a7d4a8b1766e26137f2d62eb20daee177c9
-
SHA512
b2af21e24fdef46de10b8e0d519fea0451fb38695645a7e07fba0bb4faf717eaa54300a73d742cbe742b26edd85f9656b7b6f97d2e6f9ddd393b130730ceccb6
-
SSDEEP
96:uzVs+ux7RGLLY1k9o84d12ef7CSTUSGT/ka88pi7lVHcEZ7ru7f:csz7RGAYS/zWi7PHb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426676605" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c0000000002000000000010660000000100002000000030acc1bd59a4044c1dd65e40a1961e8371173143eb0c2db8c5e082e51a617199000000000e80000000020000200000001ebff0c0d3fefaddb70ae4f940dbbecd42d7e3098fed4da4bab45b483e23140a2000000080225d882477df249b4580f3533fb50debaeb1c1a6e05e0d867c51083774c81140000000d8b3547338e509e6fa03d51e384b58a020fe9d0f66cdb87426f6ed292d9cfaa599f8872fe382781badb0b8c3f868d7111b0bb894de264c079eddcf5125b4305b iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000000122ef14a9f4b90359a43ceecad31f7673ad109b32eded6535efc1ccec80726c000000000e8000000002000020000000e77387683bfd5a3a1457814e5f7d04cebc42a366e3199a0838964eccd1c67ac9900000008e8f27d91476d4295ec32c1c7ee208ad247f6872ca51bf3357d1a4f2480219e0a6d5dc9a9b9c9861b918e63af320437714dfaf7e0f29fe51d502bf8b83d4a7145711bf9bbcf3b8f8ce6b2ae36d340fc0e191e5c02b53ea01ff974b1d097b6d528176afedccdc9edc5c5186d082808c8a273a8678ab31b56622b6401b097ebefa21f3b25e9e5a20950b5c19242fbc642040000000a227de5046a144a9578a60f88de40343ef1dc29f05b58a75f21d20230463ee8f355b83880c1e5fb92f12e2f77fb2b995bf1a95d1f6f78a84df1d2e91c1c4cb7e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9CF6E6F1-3DCF-11EF-AD79-76B5B9884319} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10598e73dcd1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2604 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2604 iexplore.exe 2604 iexplore.exe 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2604 wrote to memory of 2304 2604 iexplore.exe 31 PID 2604 wrote to memory of 2304 2604 iexplore.exe 31 PID 2604 wrote to memory of 2304 2604 iexplore.exe 31 PID 2604 wrote to memory of 2304 2604 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2ed592b6374a126f4864eef2129cc33d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2604 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2304
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5de6cf9c7479790d3ea2903bb942561d8
SHA147fb9a73c73ac596bd6a03c0905546578a144f44
SHA2564b1dc9a65d60cc8780873589ec03cb1ce981285b4847c6cdd3e9a5fc0c11c398
SHA512330f72d225f94bdcd7ff8923f28bcee62441d2f87c2bcaa37ebf3ba9f953c5ef81d779efb19974f066e32a9cedaae93c2bb329a36eb26cda3f3104ad10fa88b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5703b9663be0644bd7cdc73f91e3edc86
SHA1200eca8ca2837336f0f556b8f8ebb8327ec4758f
SHA2560b2e7aca8abc826b7bdb59f07136346305aa4ee1219a37e498c7902909c77a74
SHA51243e891e057f010f4a6e6bf6b993688a6aed22254a87ef8ff383ca7b1ee3b05e6c47faca941a822771b1375e749699b984be64874c555da59dd635af61c0c48dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5c87960cd1b912e8cf39b87226a761c2e
SHA1fa0ca4dc84eabf8efff3f187a2ac3e2f3d53387d
SHA256f8ed76829c65e6dcd1e945b1d17a952f28d54e33a0b627c90b828aff0c065300
SHA512a3e0769b8e06bc7efe6f82e8ad4eb57e2377faaa80a2a5358d79f5126c9ad08353a665715cade0f15974093c54632357bb0247a668619f2e00f4b4a596a64c86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b6144e6c612f13cf4302bb3a94a46093
SHA1eeb5827f23ecc3f71644c74edaacd54047030f32
SHA256a280409114a6a3a2e0438e48b771f6a5335e65c6c3e3fb01332e774e0304eed4
SHA51249909023a71bb5e777bbbd8385a1e09dff53ed55425b68a8251e03c08eb9a0a5fde67b102d55ada3103abf24214d20581b30a91a065e37255d880fbd5d0fb28b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e835221efc4159cd795af6f5009618f4
SHA1ebc2c85ee258b9178e0c500c915f8a8dbb76529c
SHA256c4d5e3074181fd51d1f67e4f301273e39885cd1a634e0f047a41e02c2112886e
SHA512cec126a6f18bc779e19ec336c48b3c2b96e0ffec53a46a60cc959b8b11be29b0db7e94f5706b63f95237239e328e05eb7ad597972e74f53d71d3d334bf59d5d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a2035706ccfca3f824d23f00d8e94ee3
SHA19203ca73733f4304a4a1748c9a6dbb8e0b3fcba6
SHA2565baffcd66de14d210a5ee3a975b78b8c9b35de6a2ee7ef694a9ee72322ee9f3f
SHA5122f89372c95f2274731171d3930c8a0fbcfba36e926561a0230f1849f41c2bf91c43c97ef9964b5739f4338c1c6dbf5a74e523fb83dbf162e428570fb9f6c820d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55cd6f093a1ea6e65b852a0a5f417c5d9
SHA195e3b7f10677358dc5f857f7ab0b333da525b61e
SHA256ef666cc18043f3b41d63dc98e3c364b2e828fc3e2c70758770920fd3230a7372
SHA51279134d7e3fe288e37e20f5fb0c63d68c48cfba5ea54b1d1048d22ab67405d0f7be8afb9823528423f78a2fc4d6e1b740870d08f4f7546a74bdfe1a37ce81640a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59fbb5463b607ce796637c37df88e215a
SHA1c1103ef93e63bf6cd88d18ff62608901e8b98761
SHA2567afb880c0324417b6f1d89125d905e9f1a845ae88a83e7357cae468abebf0095
SHA5128007dac36831b5f60bf07e4379f787889238991ea886ab4716fef5dbf3b5df91aa060c446f669558fb5adc5073f9855a26bc0e66a3c797cb2e3a3c53a5b106c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5c0b090782805681d2c29d5edf8cfc2ff
SHA1fd2ca183a15925885bd5482d00a3c3a4998f7261
SHA256ed48abac6613c673347e04db0cc6e9df8bc8e850fb2585b147a12e24855f156b
SHA5126373a17e78753baad960cb8e7754d2067164cb552c21721dc2190976a358d3570f46413efa42720f34e7a622868b909895b9d349d968b50bf46a392415d51d41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a48dd695ab0d7558f6a634ca61fa9c8d
SHA1fb2747f4e35e758a515c8505dd81cc5ccf09762c
SHA256cf008973886dc6658d78fc43a11738c1b739f0836e5bce8f4a670c3dae3c74fd
SHA5126b435aa4e8e9c8f0167a57b0317989f0d3092f82dc27006dc294d6fd155efda682c13ee721c23437312f0a10e027cc8ab174c2470b484569eb83f1ed1960201e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD54ec0b968c1b7e4059cc573011df7faaf
SHA192366b32965463a987af472786fed5063714444b
SHA2565a9cbb5194acc1020dbe0082e13b6530aad68ac36338a97d4ca799cf6b06f2d1
SHA512ea9ebc05bef7ebc5c44777eaa24e7dc4683f82084c1c499be3a138bdfa3f3687b1552697f4345b0a0dd1e9b5c2e5b7908c7043282c49a784da91f1a8367dbf41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f27ded1129f89650db77fb59e9ef2c9d
SHA1e628811d64e730d3625689047ac5bbe1dcf3c41c
SHA256177c84798bf8add41e498dc0c9e576953c5719b2b3e2a7cdc179c9f20daf9938
SHA5125770afba8f977621817610c7f133c8e4f440813c189f60063c09f63c1468ff9d57a8c7f88e02548da006d9070a6650288d35d7fc257143c8aa0c55404185c11c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d1b3d7813358ce07ae9c9b8b4abd4246
SHA11bbe914e8cee430b12af624e0f447fff877ac2ea
SHA256cc08a014fedf750e72ad9345ea3408bbca79e7b12af65836d6b1637cea88b85a
SHA5122d3e5a2364601ecfbedb6baf361f245f8ac26ddf61828dec4a64feabf89357c3c149af8da4ad664bc6421a61bc1d6e8a70750026783333bfb15a094c8ff8be2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b613f1446c4cbb4867c3a9dd0a4064dc
SHA1790165eced169cdb7a3767c8654904f9efc5c39c
SHA2565b82c2dcd893d24c04cfe9ef920f8ed2eb7e48baf88d4341e9f98b29f0b53916
SHA512ca03f7b4120b1f49594b0067927fb35f2322c17c51cbff03193f6e2c80da84f64133e5b820812276340337e3c37e7a597ad650112544b0c5233b4c22ef9fef85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5718d3aa37bbd0138299cdf3989787ab4
SHA1e1dc2f97f42d4e9ab24690ee2f63135ecf643aca
SHA256337f0c44ae35472d01732d40c021ba9862ec083f92c450e9ed501bf782b5aabd
SHA5122502254648c4208aac52396c2db0808504084665d453264621508d266eda5a5cdfe63f4a0a052bf741e7e9d9b4bbe06c954e6b97e2a29cc72bbca7fc334ec44f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e3368bacfeec1a6d2145fd3564b6bdbe
SHA1680209baa9576677192e3030632cffff0c762fe0
SHA25640bc9d8760f86bbde39653bce168aaf3e99929dfdfcc31c430196b9214d70e83
SHA512baf22c57940babf6612ee0405660acdd831865ddf9d77be7f3bd2a05c04345029eb3998bd2abe65c16af2ad44885e32a465d77e4417740b58adc55a4fe78f75e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD56f462f4ba1da6aa2a7a20d477c4675d9
SHA112df9b4a92cb2a892aa4abf3fe1b387be29a4d18
SHA256f17fa96b0ccfe0068ae30b714ff3496afbede2558a1f6e0732049a4cb574ceb2
SHA512c77699ec509be2b531b89cef6c9bf3483391c7e145f127c05c7962e381c48840bd9f1e5e777f3a0e1a35bdf18b3957e9a9660a3d3417a8776c48e819b6c18223
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f014c53f3cba4d85df5fbb0d94f14480
SHA13c0f4f62f87cee3dcf7d183ba33f6bfc84b1c4fd
SHA25691505d98698ad7e82a53fc7e4db46ccfc1f7df2c581045468b9a3a09bed064ee
SHA512493b8f8f0828f0191887435717a99d435804f798ec9535f4efd67c0e030dfa95291dd4be624f2388893881c737788e6e75e1cf3e529c0584a734322b0da151c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD566fbc81a2204a2853df45f8357261a0f
SHA1cb2dbb8140ed403f548427d893dbed4efe77211d
SHA256ddc56c39a81c6432572d382c1ae0dae6771acd517cb99f3e7f57cc86012e9493
SHA512066c455f9e1ef7b7318182d085645202f698bb5e3f6a7767c87a3a3d117c98ea654334ff2ae3cfcf1742cf73d32bdb50e9efbd225a3dbc4f2121cd832a6f0ef0
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b